PT-2026-22727 · WordPress · Ninja Forms+4

Nabil Irawan · Published 2026-03-03 · Updated 2026-03-03 · CVE-2026-2568

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress versions up to and including 1.1.5

Description The plugin is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping when handling form submission data. This allows unauthenticated attackers to inject malicious web scripts into pages. When a user accesses a page containing the injected script, the script will execute.

Recommendations Update the WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress to a version later than 1.1.5.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2568

Affected Products

Elementor

Formidable

Ninja Forms

Wp Zendesk For Contact Form 7

Wpforms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-2568 · Security Note
• https://twitter.com/VulmonFeeds/status/2028788502847013234 · Twitter Post
• https://t.me/CVEtracker/46195 · Telegram Post
• https://twitter.com/infoflowcloud/status/2028775038208372782 · Twitter Post
• https://twitter.com/cyberbivash/status/2028787009280504311 · Twitter Post
• https://twitter.com/CVEnew/status/2028774016362705298 · Twitter Post
• https://t.me/cveNotify/153897 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3467904 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/27d26d1c-d027-4a22-af49-4d7684d36d40?source=cve · Note